Cpe:2.3:a:azexo:store_locator:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3aazexostore_locator/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 09 Nov 2026 19:56:37 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgAZEXO Store Locator: Arbitrary file write and remote code execution (CVE-2026-115204)https://feed.craftedsignal.io/briefs/2026-11-azexo-store-locator-rce/Mon, 09 Nov 2026 19:56:37 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-azexo-store-locator-rce/The AZEXO Store Locator WordPress plugin through 1.4 fails to perform capability or nonce checks on AJAX actions and lacks sanitization of request headers used for file path construction, allowing authenticated users to perform arbitrary file writes leading to remote code execution.<p>The AZEXO Store Locator WordPress plugin through 1.4 does not perform capability or nonce checks on its AJAX actions and does not sanitise a request header used to build a file path. This allows an authenticated user, such as a subscriber, to write a file with an arbitrary name, location, and content, leading to remote code execution.</p> highadvisorywordpresspluginrcecve-2026-115204